Breaking the Python sandbox of the AWS MCP Server

Security researcher xplo1t publicly disclosed a method to bypass the Python sandbox of the AWS MCP Server's aws___run_script tool and obtain system command execution in the AWS Lambda environment. The sandbox uses two layers of protection, AST static validation plus runtime proxies, to block dangerous attribute reads; the author used the mechanism by which Python 3.10 match/case class patterns implicitly read attributes via __match_args__ to bypass validation, then used the mutable proxy class the sandbox returns for functions to read the real function's __globals__, restored __import__, and executed the id command with subprocess. After the escape, the AWS_ACCESS_KEY_ID and other credentials of the Lambda execution role and the sandbox source code could be read, but all AWS API calls by that role except sts:GetCallerIdentity were explicitly denied, the credentials belonged to an AWS-owned account, and testing found no access to other sessions or customer data.